############################## [ UsbFix V3.022 # Scan ]
# User : DATA (Administrateurs) # DOMICILE-15E69E
# Update on 19/05/09 by Chiquitine29, C_XX & Chimay8
# WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
# Start at: 23:46:08 | 19/05/2009
# Intel(R) Pentium(R) 4 CPU 3.20GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 2
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Enabled
# AV : avast! antivirus 4.8.1335 [VPS 090519-0] 4.8.1335 [ Enabled | Updated ]
# A:\ # Lecteur de disquettes 3 ½ pouces
# C:\ # Disque fixe local # 27,95 Go (3,79 Go free) # NTFS
# D:\ # Disque fixe local # 28,25 Go (25,33 Go free) [DISK1_VOL2] # FAT32
# E:\ # Disque fixe local # 20,48 Go (6,22 Go free) # NTFS
# F:\ # Disque CD-ROM
# G:\ # Disque amovible # 7,52 Go (7,51 Go free) [INTENSO] # FAT32
# H:\ # Disque amovible # 962,07 Mo (956,98 Mo free) # FAT32
# I:\ # Disque amovible # 248,62 Mo (189,7 Mo free) # FAT32
############################## [ Processus actifs ]
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\A-DATA\USB Flash Disk Utility\PLBkMon.exe
C:\WINDOWS\system32\HotfixQ0306270.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\WINDOWS\system32\qttask.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\FICHIE~1\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscript.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\maxplus2\max2win.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
################## [ Registre # Startup ]
HKLM_logon: "Userinit"="userinit.exe,"
HKLM_logon: "DefaultUserName"="DATA"
HKLM_logon: "AltDefaultUserName"="DATA"
HKLM_Run: IMJPMIG8.1="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
HKLM_Run: MSPY2002=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
HKLM_Run: PHIME2002ASync=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
HKLM_Run: PHIME2002A=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
HKLM_Run: SSBkgdUpdate="C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
HKLM_Run: PDF3 Registry Controller="C:\Program Files\ScanSoft\OmniPage15.0\PDFConverter3\\RegistryController.exe"
HKLM_Run: ADATA_PLUtil=C:\Program Files\A-DATA\USB Flash Disk Utility\PLBkMon.exe
HKLM_Run: PLFFAP=C:\WINDOWS\system32\HotfixQ0306270.exe
HKLM_Run: SkyTel=SkyTel.EXE
HKLM_Run: igfxtray=C:\WINDOWS\system32\igfxtray.exe
HKLM_Run: igfxhkcmd=C:\WINDOWS\system32\hkcmd.exe
HKLM_Run: igfxpers=C:\WINDOWS\system32\igfxpers.exe
HKLM_Run: RTHDCPL=RTHDCPL.EXE
HKLM_Run: Alcmtr=ALCMTR.EXE
HKLM_Run: EoEngine=
HKLM_Run: PCSuiteTrayApplication=C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
HKLM_Run: Adobe Photo Downloader="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
HKLM_Run: QuickTime Task="C:\WINDOWS\system32\qttask.exe" -atboottime
HKLM_Run: avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
HKLM_Run: CTFMON=C:\WINDOWS\system32\wscript.exe /E:vbs C:\WINDOWS\system32\winjpg.jpg
HKLM_Run: regdiit=C:\WINDOWS\system32\winxp.exe
HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKCU_Run: CTFMON.EXE=C:\WINDOWS\system32\ctfmon.exe
HKCU_Run: swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
HKCU_Run: eblbaxod=c:\documents and settings\data\local settings\application data\eblbaxod.exe eblbaxod
HKCU_Run: Instant Access=C:\WINDOWS\system32\nsinet.exe /res
HKCU_Run: PcSync=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
HKCU_Explo: "NoDriveAutoRun"=hex:ff,ff,ff,ff
HKCU_Explo: "NoDriveTypeAutoRun"=dword:00000000
################## [ Fichiers # Dossiers infectieux ]
Found ! C:\WINDOWS\system32\winjpg.jpg
Found ! "C:\WINDOWS\system32\bycool"
Found ! "C:\WINDOWS\system32\bycool1"
Found ! "C:\WINDOWS\system32\f"
Found ! C:\winfile.jpg
Found ! D:\winfile.jpg
Found ! E:\winfile.jpg
Found ! G:\winfile.jpg
Found ! H:\winfile.jpg
Found ! I:\winfile.jpg
################## [ Registre # Clés Run infectieuses ]
Found ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "CTFMON"
Found ! HKLM\Software\Microsoft\Windows\CurrentVersion\Run "regdiit"
Found ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
Found ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe
Found ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe
Found ! HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
Found ! HKLM\software\microsoft\windows nt\currentversion\image file execution options\MSConfig.exe
Found ! HKLM\software\microsoft\security center\\ "AntiVirusOverride"
# -> ( Value = 0x1 | Good = 0x0 Bad = 0x1 )
################## [ Registre # Mountpoints2 ]
HKCU\...\Explorer\MountPoints2\{0e6ec9f6-125d-11de-a5ca-001d7d4c58bd}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{0e6ec9f6-125d-11de-a5ca-001d7d4c58bd}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{1ff90135-ac3f-11dd-a450-001d7d4c58bd}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{1ff90135-ac3f-11dd-a450-001d7d4c58bd}\Shell\ouvrir\Command
HKCU\...\Explorer\MountPoints2\{2af10511-7411-11dd-a378-001d7d4c58bd}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{3c1b6bff-439a-11dd-8227-000fea673648}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{3c1b6bff-439a-11dd-8227-000fea673648}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{45dfe940-1d0f-11dd-8174-000fea673648}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{45dfe940-1d0f-11dd-8174-000fea673648}\Shell\explore\Command
HKCU\...\Explorer\MountPoints2\{45dfe940-1d0f-11dd-8174-000fea673648}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{61708c3a-1da2-11dd-8176-000fea673648}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{61708c3a-1da2-11dd-8176-000fea673648}\Shell\explore\Command
HKCU\...\Explorer\MountPoints2\{61708c3a-1da2-11dd-8176-000fea673648}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{7044d739-c5ff-11dd-a4ac-001d7d4c58bd}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{7044d739-c5ff-11dd-a4ac-001d7d4c58bd}\Shell\ouvrir\Command
HKCU\...\Explorer\MountPoints2\{8826796b-425a-11de-a663-001d7d4c58bd}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{934fef0e-036e-11de-a595-001d7d4c58bd}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{934fef0e-036e-11de-a595-001d7d4c58bd}\Shell\ouvrir\Command
HKCU\...\Explorer\MountPoints2\{a0a88978-ec70-11dd-a540-001d7d4c58bd}\Shell\explore\Command
HKCU\...\Explorer\MountPoints2\{a0a88978-ec70-11dd-a540-001d7d4c58bd}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{a3827118-9ed7-11dd-a42b-001d7d4c58bd}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{a3827118-9ed7-11dd-a42b-001d7d4c58bd}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{a5664c46-08ca-11dd-813d-000fea673648}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{a5664c46-08ca-11dd-813d-000fea673648}\Shell\explore\Command
HKCU\...\Explorer\MountPoints2\{a5664c46-08ca-11dd-813d-000fea673648}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{c5a46b58-2be5-11dd-819c-000fea673648}\Shell\Auto\Command
HKCU\...\Explorer\MountPoints2\{c5a46b58-2be5-11dd-819c-000fea673648}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{d9a5f27a-ab6b-11dd-a44f-001d7d4c58bd}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{d9a5f27a-ab6b-11dd-a44f-001d7d4c58bd}\Shell\ouvrir\Command
HKCU\...\Explorer\MountPoints2\{dc8abb2a-b023-11dd-a45f-001d7d4c58bd}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{dc8abb2a-b023-11dd-a45f-001d7d4c58bd}\Shell\explore\Command
HKCU\...\Explorer\MountPoints2\{dc8abb2a-b023-11dd-a45f-001d7d4c58bd}\Shell\open\Command
HKCU\...\Explorer\MountPoints2\{ed757558-52c1-11dd-8280-000fea673648}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{ed757559-52c1-11dd-8280-000fea673648}\Shell\AutoRun\Command
HKCU\...\Explorer\MountPoints2\{ed757559-52c1-11dd-8280-000fea673648}\Shell\open\Command
################## [ ! Fin du rapport # UsbFix V3.022 ! ]